mirror of
https://github.com/torvalds/linux.git
synced 2026-09-19 00:58:02 +02:00
cbbef43bdc
split_strings() walks each directory entry with strlen(). Although the transport adds a terminator after the reply buffer, a malformed reply without a final NUL inside its advertised length would let that walk cross the protocol payload boundary. Reject such replies before counting the strings. Report the protocol violation once and return -EIO to the caller. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: Juergen Gross <jgross@suse.com> Signed-off-by: Juergen Gross <jgross@suse.com> Message-ID: <20260626223738.43742-1-alhouseenyousef@gmail.com> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| xenbus_client.c | ||
| xenbus_comms.c | ||
| xenbus_dev_backend.c | ||
| xenbus_dev_frontend.c | ||
| xenbus_probe_backend.c | ||
| xenbus_probe_frontend.c | ||
| xenbus_probe.c | ||
| xenbus_xs.c | ||
| xenbus.h | ||